CloudLabBox
Try the free demo

Aruba CX lab 8 of 16

ACLs and policies with control-plane protection and QoS

Protect Northwind's servers and switches on AOS-CX: an object-group-based ACL on the user port, a control-plane ACL that limits SSH to the admin workstation, and a classifier policy that marks voice traffic with DSCP EF.

Run this lab

It needs Lite: its 3 nodes are set to 4 vCPU and 4,096 MB in total. That fits the free demo too.

In your workspace: Shared, then HPE Aruba Networking CX switching guided labs, then 08 - ACLs and policies with control-plane protection and QoS

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
4 vCPU, 4,096 MB
Smallest plan
Lite

The scenario

An audit at Northwind Logistics found that anyone on the user VLAN can reach the switches' infrastructure addresses and try SSH logins, and that voice traffic from the warehouse handsets isn't marked for priority. The policy:

  • users may reach the server srv30 with ping, SSH (22), HTTP (80) and HTTPS (443) only, and nothing in 10.255.0.0/24;
  • only the admin workstation h10 (10.10.10.11) may SSH to the switch;
  • UDP voice traffic (ports 16384–32767) from user ports is marked DSCP EF.
DeviceInterfaceAddress
core1vlan 10 / vlan 30 / loopback 010.10.10.1/24 · 10.30.30.1/24 · 10.255.0.1/32
h10eth0 (core1 1/1/1)10.10.10.11/24 via 10.10.10.1
srv30eth0 (core1 1/1/2)10.30.30.100/24 via 10.30.30.1

User netops (password Aruba-Lab1) and SSH in VRF default are already configured.

What you’ll practise

  • Build address and port object groups and use them in an IPv4 ACL
  • Apply an ACL to a user port, know the other places AOS-CX can apply one, and read its hit counts
  • Restrict management access with a control-plane ACL
  • Classify traffic with a class and mark it with a policy (DSCP EF)
  • Explain ACL order, the implicit deny and where to apply filters

The tasks

  1. Baseline
  2. Object groups
  3. The user ACL
  4. Protect the control plane
  5. Mark voice traffic

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of ACLs and policies with control-plane protection and QoS3 nodes, 2 links. Every link is listed as text below the diagram.core1h10srv301/1/1eth01/1/2eth0
3 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • core1 1/1/1 to h10 eth0
  • core1 1/1/2 to srv30 eth0
Nodes in ACLs and policies with control-plane protection and QoS, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
core1Aruba AOS-CX virtual switcharubacx-10.142 vCPU, 3,072 MB
h10Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
srv30Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder HPE Aruba Networking CX switching guided labs.

  3. Open 08 - ACLs and policies with control-plane protection and QoS and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Aruba CX labs

All Aruba CX labs

Related labs in other courses

CloudLabBox is independent of Hewlett Packard Enterprise. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.